Obligations Map October 2024

US State SensitiveData Definitions

Start

Obligation List

Last updated: October 25, 2024

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

9

12

2

1

13

14

11

10

4

8

7

6

5

3

Unique Identification Numbers

CA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Financial and Account Information

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, NJ

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Geolocation

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Personal Characteristics

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA*, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Mail, Email, and Text Messages

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Genetic

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Biometric

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, CO, CT, DE, IA, IL, IN, KY, MD, MN, MT, NE, NH, NJ, RI, OR, TN, TX, UT, VA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Sex Life, Sexual Orientation, or Status as Transgender or Nonbinary

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA CO , CT , DE , IA, IN, KY, MD , MN, MT , NE, NH , NJ , RI , OR , TN, TX, UT, VA

US State Sensitive Data Definitions

†

†

†

††

† ††

†

†

† ††

†

††

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CO CT DE IA IN KY MN MT NE NH NJ OR RI TN TX UT VA

Mental or Physical HealthCondition or Diagnosis

US State Sensitive Data Definitions

¶ §

¶ §

¶ §

§

#

§

¶ §

¶ §

§

¶ §

¶ § ||

¶ §

¶

§

§

¶

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Children's Data

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CO**, CT**, DE, FL***, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, VA

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Victim of a Crime

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CT, OR

US State Sensitive Data Definitions

Consumer Health

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

9

12

2

1

13

14

11

10

8

7

6

5

CA, CT, MD, NV, WA

3

4

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Biological

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, CO

US State Sensitive Data Definitions

9

12

2

1

13

14

11

10

8

7

6

5

3

4

Inferences

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary††Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,#Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crimeConsumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

CA, NV, WA

US State Sensitive Data Definitions

CHDOnly

CHDOnly

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership) The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life, sexual orientation, or status as transgender or nonbinary Mental or physical health condition or diagnosis, or medical treatment by a health care professional Personal data collected from a known child (under 18 years of age) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumerand that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account)Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership)The contents of mail, email, and text messages, unless the company is the intended recipient of the communicationGenetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life, sexual orientation, or status as transgender or nonbinary Mental or physical health condition or diagnosis, or medical treatment by a health care professional Personal data collected from a known child (under 18 years of age) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumerand that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

2

9

12

13

14

11

1

10

8

7

6

5

4

3

US State Sensitive Data Definitions